Draft: the owner’s details are missing (the bracketed texts).
Privacy Policy
Last updated: September 24, 2026
This policy explains what personal data Dose (the Android app and the website dose.am) processes, what we use it for, who we share it with and what rights you have. It applies to users in the European Union (General Data Protection Regulation, GDPR) and in the United States, including California (CCPA/CPRA).
1. Who is responsible
- Controller: [TITULAR]
- Tax ID: [NIF/CIF]
- Address: [DIRECCIÓN POSTAL]
- Privacy contact: [EMAIL DE CONTACTO]
2. What Dose does, in short
Every day Dose prepares an audio clip (a dose) from a setup of yours (a recipe): it gathers data from the sources you choose (weather, news, calendar, email…), a language model writes a script, a voice service turns it into audio and we send it to your phone so it rings at the time you picked. To do that we need to process the data described below, and only that.
3. What data we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: email and internal identifier | Identify you, give you access and contact you about the service | Performance of the contract |
| Your phone’s notification identifier (Firebase Cloud Messaging token) | Deliver each dose to your device | Performance of the contract |
| Recipes: topics, places (city name and approximate coordinates), time, time zone, language, voice and length | Generate your doses and ring at your time | Performance of the contract |
| Connected accounts (if you connect them): Google Calendar, Google Tasks. We store the access grant encrypted and read the day’s events and tasks when generating the dose | Tell you about your schedule and tasks in the dose | Consent, which you can withdraw by disconnecting the account |
| Email you forward to your recipe’s address | Summarize it in the dose | Performance of the contract |
| Generated doses: script (text) and audio | Send them to you, let you replay them from your history and troubleshoot | Performance of the contract |
| Subscription: plan, status and dates, as reported by Google Play. We never see or store your card details | Know what your plan includes and meet billing obligations | Performance of the contract and legal obligation |
| Usage and technical data: number of doses, audio minutes, errors, app version and phone model | Apply plan limits, measure costs and fix bugs | Legitimate interest in keeping the service working |
We don’t use your data for advertising, we don’t build profiles for third parties and we don’t sell personal data. We don’t ask for access to your location, contacts, microphone or camera.
4. How a dose is made and what happens to the data
- Between 15 and 40 minutes before your time, we gather the data for your recipe (the “facts”).
- A language model writes the script from those facts. We use it with no retention: the provider doesn’t keep what we send or use it to train models.
- A voice service turns the script into audio.
- We store the audio and the script, and send the dose to your phone.
- The facts are deleted when we’re done: we keep no copy of your events, tasks or emails after the dose is generated.
Google user data
Dose’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request read access, only read what the day’s dose needs, don’t transfer it to third parties other than the providers that generate the dose, don’t use it for advertising and don’t use it to train AI models.
5. Who we share data with
Only with providers that process data on our behalf (processors), under contract and only as needed:
- Google (Firebase Cloud Messaging and Google Play): notification delivery and subscription management.
- Cloudflare: hosting for the website and the service, audio storage, the language model and receiving forwarded email.
- [PROVEEDOR DE VOZ]: speech synthesis from the script.
For some ingredients we query public sources (for example, weather forecasts or news headlines). Those queries carry only what’s needed (the city’s approximate coordinates or the search topic) and don’t identify you.
We may also disclose data when required by law or by a competent authority.
6. International transfers
Some providers are in the United States or process data outside the European Economic Area. Those transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or otherwise on the European Commission’s Standard Contractual Clauses.
7. How long we keep data
- Account and recipes: for as long as you have an account. When you delete it, they’re erased (see Delete your account).
- Facts used to generate a dose (events, tasks, emails, news): deleted as soon as the dose is generated.
- Dose audio and scripts: 30 days, for your history.
- Connected account grants: until you disconnect them or delete your account.
- Billing records: as long as the law requires (in Spain, up to 6 years).
- Technical logs: 90 days at most.
8. Your rights (European Union)
You can ask to access your data, correct it, erase it, restrict or object to its processing, receive it in a portable format and withdraw your consent at any time. Write to [EMAIL DE CONTACTO]; we reply within one month. If you think we haven’t handled your request properly, you can complain to the supervisory authority; in Spain, the Agencia Española de Protección de Datos.
9. U.S. residents (including California)
In the last 12 months we have collected, for the purposes in section 3, these categories: identifiers (email, internal identifier, device token), commercial information (subscription plan and status), internet activity (use of the service), approximate geolocation (only the cities you pick for the weather) and content you send us (forwarded email, events and tasks).
- We don’t sell personal information or share it for cross-context behavioral advertising.
- We don’t use or disclose sensitive personal information beyond what’s needed to provide the service.
- You have the right to know what data we hold, to ask us to delete or correct it, and not to be discriminated against for exercising your rights.
- You can exercise them by writing to [EMAIL DE CONTACTO], yourself or through an authorized agent. We’ll verify your identity with your account email.
10. Children
Dose is not directed at children under 16 (13 in the United States) and we don’t knowingly collect their data. If you believe a child has given us data, contact us and we’ll delete it.
11. Security
We encrypt data in transit (HTTPS) and connected account grants at rest too, keep access to the minimum and delete what we no longer need. No system is infallible: if a breach affects your data, we’ll notify you and the authorities where the law requires it.
12. Changes
If we change this policy we’ll update the date above and, for significant changes, let you know in the app or by email before they apply.
13. Contact
For any privacy question: [EMAIL DE CONTACTO].